CVE-2026-76428

Name of the Vulnerable Software and Affected Versions Cisco ISE (affected versions not specified) Cisco ISE-PIC (affected versions not specified)

Description An issue in the REST APIs allows an authenticated remote attacker with administrative credentials to perform SQL injection attacks against the session database. This occurs because certain parameters are concatenated directly into SQL clauses without parameterization, which is the practice of using placeholders to prevent malicious input from being executed as code. An attacker can send a crafted request containing SQL statements in an affected parameter to read information from the session database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.